Vault Enterprise Multiple Select — 20 Questions

Question 1

Which TWO configurations are required to effectively monitor Vault in a production environment?

Accepted Answer

Enabled telemetry endpoint.. Production environments require robust monitoring of metrics and thorough audit logging for compliance and troubleshooting.

Answer

Manual log rotation cron job.

Answer

UI access restricted to local IP only.

Answer

Debug mode enabled on all nodes.

Question 2

Which TWO fields are essential in an ACL policy defined in HCL?

Accepted Answer

capabilities. The path to be restricted and the capabilities allowed for that path are the core components of an ACL policy.

Answer

ttl

Answer

entity

Answer

description

Question 3

Which TWO of the following are valid reasons why a node might fail to join an existing Raft cluster?

Accepted Answer

The 'cluster_addr' is not reachable from the leader.. Configuration errors and network issues are the most common causes for joining failures.

Answer

The node has not been initialized with 'vault operator init'.

Answer

The storage backend is set to 'consul'.

Answer

The node has a different Vault version.

Question 4

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

Accepted Answer

slot. The 'seal' configuration for PKCS#11 requires the library path, the slot identifier, and the key label to locate the cryptographic material.

Answer

hsm_type

Answer

max_attempts

Question 5

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

Accepted Answer

Review logs for 'sys/policy' updates.. Analyzing logs involves filtering for unauthorized access, checking for high-risk operations, and verifying administrative actions.

Answer

Sort logs by timestamp.

Answer

Check for successful 'read' operations on all secrets.

Question 6

Which TWO of the following statements are true regarding Performance Standby nodes?

Accepted Answer

They forward all write operations to the primary cluster.. Performance standbys handle reads and improve throughput but cannot perform writes.

Answer

They maintain their own independent master key.

Answer

They can serve requests for secrets written to any cluster.

Answer

They automatically promote themselves if the primary fails.

Question 7

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

Accepted Answer

Sentinel policies support EGP and RGP types.. Sentinel policies are applied at the request level, and they support both RGP (Request Governing Policy) and EGP (Endpoint Governing Policy).

Answer

Sentinel policies are written in HCL.

Answer

Sentinel policies replace ACLs.

Answer

Sentinel policies are evaluated before ACLs.

Question 8

Which TWO factors contribute to the size and performance of Vault audit logs?

Accepted Answer

The size of the request/response payloads.. The request payload size and the frequency of incoming requests directly impact the audit log volume and performance.

Answer

The number of active leases.

Answer

The number of enabled secrets engines.

Answer

The size of the Vault data store.

Question 9

Which TWO of the following are components of a Control Group configuration?

Accepted Answer

Request TTL.. Control groups rely on defining the 'approver' entities and the 'ttl' of the request, which governs the workflow.

Answer

Secret engine path.

Answer

Policy name.

Answer

Auth method name.

Question 10

Which THREE actions are necessary when preparing to promote a Performance Secondary cluster?

Accepted Answer

Disable the existing replication link from the primary side.. Promotion requires stopping replication, updating configuration, and verifying the new cluster state.

Answer

Restart the secondary cluster.

Answer

Upgrade the secondary's license to Enterprise.

Question 11

Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?

Accepted Answer

signal. The change_mode supports 'noop', 'signal', and 'restart' actions.

Answer

delete

Answer

exec

Question 12

Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?

Accepted Answer

Compliance with FIPS 140-2/3 requirements.. Seal Wrap adds an extra layer of security by ensuring keys never exist in plaintext memory and allows for easier compliance with regulations requiring HSM-backed key protection.

Answer

Automatic failover to a standby Vault cluster.

Answer

Increased storage backend performance.

Answer

Automatic deletion of audit logs.

Question 13

Which TWO of the following statements about the 'vault-agent' injector in Kubernetes are correct?

Accepted Answer

It runs as a Kubernetes Mutating Admission Webhook.. The injector is a controller that modifies pod specs, and it uses sidecars for secret delivery.

Answer

It is only available for non-Enterprise versions.

Answer

It bypasses all Vault policies.

Answer

It requires manual pod restarts to update secrets.

Question 14

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

Accepted Answer

create. Create, Read, and Update are standard operations for secrets engines, while Delete and List are also common.

Answer

sudo

Answer

control-group

Question 15

Which THREE items are required to configure an AppRole auth method?

Accepted Answer

ACL Policy. AppRole requires a Role ID, a Secret ID (for added security), and a Policy assignment.

Answer

Root Token

Answer

LDAP Password

Question 16

Which THREE features are specific to Vault Enterprise when managing access control?

Accepted Answer

Namespaces. Namespaces, Replication, and Sentinel are all exclusive to the Enterprise version of Vault.

Answer

Token Auth Method

Answer

KV v2 Secrets Engine

Question 17

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. HA requires storage for state, a server for processing, and a mechanism to direct traffic.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 18

Which TWO of the following must be true for Seal Wrap to function correctly?

Accepted Answer

The 'seal_wrap' parameter must be set to 'true' in the configuration.. Seal Wrap requires a supported HSM and that the feature is enabled in the configuration before the keys are created or rotated.

Answer

The HSM must use the RSA algorithm for all keys.

Answer

The transit engine must be the only engine enabled.

Answer

All audit logs must be sent to the HSM.

Question 19

Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?

Accepted Answer

type. The 'sink' block requires a 'type' and a 'config' map to define the file path.

Answer

ttl

Answer

auth_method

Answer

mode

Question 20

Which THREE factors influence the effective permissions of a user in Vault?

Accepted Answer

Active Sentinel policies.. Effective permissions are the result of policies attached to the token, policies attached to the identity entity, and potentially Sentinel policies that filter the request.

Answer

The user's password strength.

Answer

The number of active mounts.